Changes to Trusted Certificate Authorities in Android Nougat • Hacker News Board

Re: Changes to Trusted Certificate Authorities in Android Nougat

#51

Post by kuschku » Sat, Jul 09, 2016, 3:41 PM UTC

johncolanduoni wrote: post #48

kuschku wrote: post #35

Earlier quoted context omitted.

And if you want to use your legal right to reverse the functionality and APIs of other apps?

If your device isn't rooted, modify the APK to opt-in and don't share it with anyone. If your device is rooted, just add your cert to the system store.

> If your device is rooted, just add your cert to the system store.

So, basically the same as before, but there’s no UI for it anymore?

Fuck this.

I might just modify the Java SSL libs on Android to even accept my cert when cert pinning is used, if I have to spend that much effort anyway.

Re: Changes to Trusted Certificate Authorities in Android Nougat

#52

Post by tszming » Sat, Jul 09, 2016, 3:44 PM UTC

tssva wrote: post #26

There are several ad blocking solutions for Android which involve creating a VPN connection which terminates to an app local to the device. This allows the app to filter all traffic for ads including ads inside apps. These solutions depend on installing a user CA certificate in order to filter TLS connections. I wonder how much preventing these type of ad blockers played into this decision.

I joked to a friend that if Google invented a time machine, the first thing they would do is travel back to remove the extension support in Chrome before it was launched - the ad blockers.

Re: Changes to Trusted Certificate Authorities in Android Nougat

#53

Post by [deleted] » Sat, Jul 09, 2016, 3:45 PM UTC

andrewguenther wrote: post #27

ITT: People who think the average Android user knows how CAs work and has the competence to manage them. For the majority of users, this is a very good decision.

[deleted]

Re: Changes to Trusted Certificate Authorities in Android Nougat

#54

Post by spikengineer » Sat, Jul 09, 2016, 3:52 PM UTC

wfunction wrote: post #43

Can this be bypassed with root access? (Note: stuff like patching binaries in memory doesn't count... I mean something that's reasonably simple for users to do, like editing a config file or something.)

Yes, I believe so

Adding your own certs to the system store in /system will make it fully trusted.

Sites that use pinning won't work anyway.

Re: Changes to Trusted Certificate Authorities in Android Nougat

#55

Post by nolok » Sat, Jul 09, 2016, 3:53 PM UTC

tszming wrote: post #52

tssva wrote: post #26

There are several ad blocking solutions for Android which involve creating a VPN connection which terminates to an app local to the device. This allows the app to filter all traffic for ads including ads inside apps. These solutions depend on installing a user CA certificate in order to filter TLS connections. I wonder how much preventing these type of ad blockers played into this decision.

I joked to a friend that if Google invented a time machine, the first thing they would do is travel back to remove the extension support in Chrome before it was launched - the ad blockers.

Chrome didn't support the proper method for ad blockers at launch (it could hide content but not stop the requests, if I remember it well), and they purposely added those in months after launch, clearly for the benefit of adblocking extensions writers who where complaining.

So, I don't think so.

Re: Changes to Trusted Certificate Authorities in Android Nougat

#56

Post by mrb » Sat, Jul 09, 2016, 3:54 PM UTC

Previous submission (did not receive many upvotes though): https://news.ycombinator.com/item?id=12052618

Re: Changes to Trusted Certificate Authorities in Android Nougat

#57

Post by userbinator » Sat, Jul 09, 2016, 3:56 PM UTC

wfunction wrote: post #43

Can this be bypassed with root access? (Note: stuff like patching binaries in memory doesn't count... I mean something that's reasonably simple for users to do, like editing a config file or something.)

Note: stuff like patching binaries in memory doesn't count... I mean something that's reasonably simple for users to do, like editing a config file or something

If you write an app for it, that'll make it simple for users. (And then no doubt you'll get a bunch of "security" people complaining that your app is malware...)

Re: Changes to Trusted Certificate Authorities in Android Nougat

#58

Post by userbinator » Sat, Jul 09, 2016, 3:59 PM UTC

nolok wrote: post #55

tszming wrote: post #52

Earlier quoted context omitted.

I joked to a friend that if Google invented a time machine, the first thing they would do is travel back to remove the extension support in Chrome before it was launched - the ad blockers.

Chrome didn't support the proper method for ad blockers at launch (it could hide content but not stop the requests, if I remember it well), and they purposely added those in months after launch, clearly for the benefit of adblocking extensions writers who where complaining. So, I don't think so.

Google is a big company; I'm pretty sure not everyone there is against adblocking. Or perhaps they managed to sneak request blocking past those who were against adblocking by advocating a different use-case --- "reader mode" comes to mind.

Re: Changes to Trusted Certificate Authorities in Android Nougat

#59

Post by tssva » Sat, Jul 09, 2016, 4:01 PM UTC

revelation wrote: post #47

tssva wrote: post #44

Earlier quoted context omitted.

Google doesn't allow these apps in the play store due to the ability to block ads in apps. Several can be found in the Amazon app store. Adclear and Adguard are 2 examples. By utilizing the local VPN to redirect traffic for filtering these apps are able to work without requiring root access as other ad blocking solutions on Android do.

You can't have ad blocking apps on the Play (god that ridiculous name) store?

You can have browser or browser extensions which block ads on the Play store. Apps which block ads within other apps are not allowed.

Re: Changes to Trusted Certificate Authorities in Android Nougat

#60

Post by maxerickson » Sat, Jul 09, 2016, 4:04 PM UTC

kuschku wrote: post #31

sounds wrote: post #11

Earlier quoted context omitted.

After reading the article, I think what you describe can easily be implemented -- at the _app_ level. The big change is that Android no longer provides an ability to add a CA for all apps on the device ("device global CA"). There is only one "global CA store" now, the one shipped with Android. Device updates can update the CA store, and the article talks about how to get your CA included.

And how can I add the CA of my university, for example, which is required for some university networks? Especially because it has to be in the global store? Or how am I supposed to use my legal right to reverse and understand the functionality and APIs of software I have installed? EDIT (as I can’t create new comments for the next hour): The certificate is not used for HTTPS – but for TLS for IMAP, for example, and f…

It seems likely the email app would opt in to user certificates.

Once the university (and their providers) have modified their apps to opt in, the user sees a net benefit. I guess it might be hilariously optimistic to expect the university and all of their providers to actually fix their software, but that's the other way of looking at that specific problem.